Automation

A powerful low-to-no-code approach that allows your SOC to start automating complex tasks on day one.

Installable workflows

These are additional workflows that you can choose to install from Cisco, its partners, and the Cisco XDR community. These are not installed by default and offer additional use cases beyond the workflows built into Cisco XDR. More information about installable workflows can be found in the Cisco XDR product documentation.

Cisco Managed

This workflow appears in the pivot menu and allows a user to block an IP address on a Cisco Meraki MX L3 outbound firewall (using the selected observable as the rule's destination).

Community

This incident response workflow consumes one or more users (user or process_username) and attempts to re-enable the local account on endpoints running windows, mac or linux This workflow is intended for use in a playbook during the recovery stage.

Community

This pivot menu workflow uses the "Delete a File" catalog script in Cisco Orbital.

Cisco Managed

This workflow appears in the pivot menu and allows a user to release a machine from isolation in Microsoft Defender for Endpoint.

Cisco Managed

This workflow appears in the pivot menu and allows a user to remove an observable from the configured destination list in Cisco Umbrella.

Built-in workflows

View all

Workflows typically achieve an end-to-end use case. For example, fetching information from an incident, identifying endpoints to isolate, and requesting isolation for each endpoint. If you're familiar with software development, think of a workflow as a script that achieves an end-to-end outcome by taking one or more smaller steps. The workflows listed here are built into Cisco XDR and do not require installation or, in most cases, configuration. More information about workflows can be found in the Cisco XDR product documentation.

Cisco Managed

This workflow consumes one or more hostnames and attempts to isolate matching endpoints in all supported products.

Cisco Managed

This workflow consumes one or more email message IDs and attempts to quarantine matching messages in all supported products.

Cisco Managed

This workflow parses an XDR incident and creates a matching/linked ticket in a supported ticketing integration.

Cisco Managed

This workflow consumes one or more domains and attempts to restore them.

Cisco Managed

This workflow consumes one or more SHA-256 file hashes and attempts to restore them.

Built-in actions

View all

Also known as atomic actions, these are small, reusable components you can use when building a workflow. Cisco XDR comes with over 500 actions built in for various products and capabilities or you can build your own. If you're familiar with software development, think of a workflow as a script that achieves an end-to-end outcome and an action as a function within the script. Actions usually do perform a specific, single task like creating a ticket or sending an instant message. More information about built-in actions can be found in the Cisco XDR product documentation.